Hi All,
Just getting started with Ansible and I'm having issues with some of the
sudo stuff.
I have a user deployer, who has limited permissions on the server. Neither
deployer nor root have a password set, I'm using ssh keys for deployer.
I am trying to give deployer permission to stop/start services on the
server, and have tried to give them access in sudoers:
deployer ALL=(root) NOPASSWD: /usr/sbin/service
In my playbook I have a task:
tasks:
- name: Stop Nginx
sudo: yes
service:
name: nginx
state: stopped
>From what I can see, the "sudo: yes" causes the script to be wrapped in an
Ansible sudo call, which uses /bin/sh to run the generated script. As the
user doesn't have permission to run /bin/sh as root the result is the play
locking up waiting for a password to be entered.
<server> ESTABLISH CONNECTION FOR USER: deployer
<server> REMOTE_MODULE service name=nginx state=stopped
<server> EXEC ['ssh', '-C', '-tt', '-vvv', '-o', 'ControlMaster=auto',
'-o', 'ControlPersist=60s', '-o',
'ControlPath=/home/cameron/.ansible/cp/ansible-ssh-%h-%p-%r', '-o',
'Port=22', '-o', 'KbdInteractiveAuthentication=no', '-o',
'PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey',
'-o', 'PasswordAuthentication=no', '-o', 'User=deployer', '-o',
'ConnectTimeout=10', 'server', "/bin/sh -c 'mkdir -p
$HOME/.ansible/tmp/ansible-tmp-1402872399.78-47692345481072 && chmod a+rx
$HOME/.ansible/tmp/ansible-tmp-1402872399.78-47692345481072 && echo
$HOME/.ansible/tmp/ansible-tmp-1402872399.78-47692345481072'"]
<server> PUT /tmp/tmpzh6oFh TO
/home/deployer/.ansible/tmp/ansible-tmp-1402872399.78-47692345481072/service
<server> EXEC ['ssh', '-C', '-tt', '-vvv', '-o', 'ControlMaster=auto',
'-o', 'ControlPersist=60s', '-o',
'ControlPath=/home/cameron/.ansible/cp/ansible-ssh-%h-%p-%r', '-o',
'Port=22', '-o', 'KbdInteractiveAuthentication=no', '-o',
'PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey',
'-o', 'PasswordAuthentication=no', '-o', 'User=deployer', '-o',
'ConnectTimeout=10', 'server', u'/bin/sh -c \'sudo -k && sudo -H -S -p
"[sudo via ansible, key=xqpamkcjagkzzsxuwdwnijqkrpitvqyy] password: " -u
root /bin/sh -c \'"\'"\'echo SUDO-SUCCESS-xqpamkcjagkzzsxuwdwnijqkrpitvqyy;
LC_CTYPE=C LANG=C /usr/bin/python
/home/deployer/.ansible/tmp/ansible-tmp-1402872399.78-47692345481072/service\'"\'"\'\'']
I could set the user to have permission to run /bin/sh, but that seems
incorrect (may as well set it to ALL, which btw does work as I desire).
Is this something that I can resolve either in sudoers, or in the Ansible
script?
Any help would be appreciated.
Cheers, Cameron
--
You received this message because you are subscribed to the Google Groups
"Ansible Project" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/ansible-project/9d3e18d5-7c56-49d3-9339-f605f87655f8%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
